By weakness (CWE)

CWE-121: related vulnerabilities

CVEs classified under CWE-121. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

105 published vulnerabilities · page 2 of 2

• CVE-2026-36778MEDIUM 4.9

  A stack overflow vulnerability has been identified in Tenda O3 Wireless Router version 1.0.0.5(4180). The flaw exists in how the router processes the username parameter when handling certain web requests. An attacker with elevated privileges on the network can send a specially crafted HTTP request that causes the router to crash, resulting in a denial of service. The router would need to be rebooted to restore functionality. This is a medium-severity issue that requires administrative-level access to exploit, limiting its immediate threat in most environments.

• CVE-2026-0413MEDIUM 4.5

  A buffer overflow flaw in NETGEAR Orbi mesh router firmware allows authenticated administrators on the local network to modify router software and functionality without authorization. The vulnerability stems from insufficient input validation, meaning an admin account could inject malicious data that overwrites system memory. While exploitation requires valid administrative credentials and local network access, the ability to alter router firmware represents a serious integrity compromise.

• CVE-2026-40510LOW 3.8

  OpenSC, a widely-used open-source smart card library, contains a stack buffer overflow flaw in how it processes the Key History Object from PIV (Personal Identity Verification) cards. An attacker with physical access to a system could craft a malicious smart card or USB device that returns an oversized URL field—exceeding 118 bytes—triggering memory corruption. This vulnerability requires the attacker to be physically present at the machine and involves user interaction, limiting its reach but posing a real concern in environments where untrusted hardware may be connected.

• CVE-2026-40528LOW 3.8

  OpenSC, a widely-used open-source library for working with smart cards and cryptographic tokens, contains a buffer overflow vulnerability in its profile configuration parser. When OpenSC's pkcs15-init tool processes a maliciously crafted configuration file, it can be tricked into copying more data than a buffer can hold, corrupting memory. An attacker would need local access to supply the malicious file and convince a user to run the initialization tool, but successful exploitation could allow memory corruption and potential code execution.

• CVE-2026-10528LOW 3.3

  Orthanc DICOM Server versions up to 1.12.11 contain a stack-based buffer overflow vulnerability in the DCMTK parser component. The flaw exists in the DcmItem::read function and can be triggered through malicious DICOM file manipulation. An attacker with local system access can exploit this to cause a denial of service condition. The vulnerability has been publicly disclosed with working exploit code available.